Remote System Discovery, Technique T1018 - Enterprise (original) (raw)
2015 Ukraine Electric Power Attack
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets. [3]
2016 Ukraine Electric Power Attack
During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.[4]
AdFind has the ability to query Active Directory for computers.[5][6][7][8]
Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.[9]
Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.[10]
APT3 has a tool that can detect the existence of remote systems.[11][12]
APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.[13]
APT39 has used NBTscan and custom tools to discover remote systems.[14][15][16]
APT41 has used MiPing to discover active systems in the victim network.[17]
Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.[18][19]
Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.[20]
BADHATCH can use a PowerShell object such as, System.Net.NetworkInformation.Ping to ping a computer.[21]
Bazar can enumerate remote systems using Net View.[22]
BitPaymer can use net view to discover remote systems.[23]
Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.[24]
BlackByte used tools such as Arp to identify remotely-connected devices.[25][26]
BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.[27]
BloodHound can enumerate and collect the properties of domain computers, including domain controllers.[28]
BRONZE BUTLER typically use ping and Net to enumerate systems.[29]
During C0015, the threat actors used the commands net view /all /domain and ping to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.[30]
Carbon uses the net view command.[31]
Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.[32]
Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.[33][34][35]
Comnie runs the net view command
Conti has the ability to discover hosts on a target network.[36]
CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.[37]
Deep Panda has used ping to identify other machines of interest.[38]
Diavol can use the ARP table to find remote hosts to scan.[39]
Dragonfly has likely obtained a list of hosts in the victim environment.[40]
DRATzarus can search for other machines connected to compromised host and attempt to map the network.[41]
DUSTTRAP can use ping to identify remote hosts within the victim network.[42]
Earth Lusca used the command powershell "Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list - property * | findstr "Address"" to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.[43]
Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.[44]
Epic uses the net view command on the victim’s machine.[45]
FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.[46]
FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.[47]
FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.[48][49]
Flagpro has been used to execute net view on a targeted system.[50]
Fox Kitten has used Angry IP Scanner to detect remote systems.[51]
FunnyDream can collect information about hosts on the victim network.[52]
During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.[53]
GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.[54]
Gomir probes arbitrary network endpoints for TCP connectivity.[55]
HAFNIUM has enumerated domain controllers using net group "Domain computers" and nltest /dclist.[56]
Havoc features a module capable of host enumeration.[57]
HermeticWizard can find machines on the local network by gathering known local IP addresses through DNSGetCacheDataTable, GetIpNetTable,WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY),NetServerEnum,GetTcpTable, and GetAdaptersAddresses.[58]
HEXANE has used net view to enumerate domain machines.[59]
Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.[60]
Industroyer can enumerate remote computers in the compromised network.[61]
Ke3chang has used network scanning and enumeration tools, including Ping.[62]
Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.[63]
Kwampirs collects a list of available servers with the command net view.[64]
Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.[65]
Leviathan Australian Intrusions
Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions.[66]
LODEINFO can run net view and net view /domain for network discovery.[67]
Lotus Blossom has used Ping to identify remote systems.[68]
Magic Hound has used Ping for discovery on targeted networks.[69]
Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network.[70]
menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.[71][72]
MgBot includes modules for performing ARP scans of local connected systems.[73]
MirrorFace has used Ping for system discovery.[74]
MURKYTOP has the capability to identify remote hosts on connected networks.[75]
Mustang Panda has queried Active Directory for computers using AdFind.[76] Mustang Panda has also utilized SharpNBTScan to scan the victim environment.[77]
Naikon has used a netbios scanner for remote machine identification.[78]
NBTscan can list NetBIOS computer names.[79][80]
Commands such as net view can be used in Net to gather information about available remote systems.[81]
njRAT can identify remote hosts on connected networks.[82]
Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.[83]
Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.[84]
During Operation CuckooBees, the threat actors used the net view and ping commands as part of their advanced reconnaissance.[85]
During Operation Digital Eye, threat actors used Ping for reconnaissance.[86]
During Operation Wocao, threat actors used nbtscan and ping to discover remote systems, as well as dsquery subnet on a domain controller to retrieve all subnets in the Active Directory.[87]
OSInfo performs a connection test to discover remote systems in the network[11]
Ping can be used to identify remote systems within a network.[88]
Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.[89]
PoetRAT used Nmap for remote system discovery.[90]
QakBot can identify remote systems through the net view command.[91][92][93]
Qilin can enumerate domain-connected hosts during its discovery phase.[94][95][96]
RansomHub can enumerate all accessible machines from the infected system.[97]
RATANKBA runs the net view /domain and net view commands.[98]
Remsec can ping or traceroute a remote host.[99]
ROADTools can enumerate Azure AD systems and devices.[100]
Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.[101]
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.[102][4]
Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.[103]
Shamoon scans the C-class subnet of the IPs on the victim's interfaces.[104]
SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.[105]
Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.[106]
SILENTTRINITY can enumerate and collect the properties of domain computers.[107]
During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.[108]
SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.[109]
Sykipot may use net view /domain to display hostnames of available systems on a network.[110]
The TAINTEDSCRIBE command and execution module can perform target system enumeration.[111]
Threat Group-3390 has used the net view command.[112]
ToddyCat has used ping %REMOTE_HOST% for post exploit discovery.[113]
TrickBot can enumerate computers and network devices.[114]
Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.[45][115]
USBferry can use net view to gather information about remote systems.[116]
Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.[117][118]
WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.[119]
Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.[7][120][121][5][122][123]